Question

I have a download script that processes my downloads:

download.php?file=file_refrence_here

How can I prevent someone from putting a link on their site such as:

http://www.mysite.com/download.php?the_file_refrence

Apparently $_SERVER[HTTP_REFER] is not secure.

Although I am just worried about general linking not people smart enough to change their header strings.

Answer 1

One way would be to include a time-limited hash which is validated before you allow the download. A distributed link then only has a small window of time in which it can be used.

For example

$file="foo.mp3";
$salt="youpeskykids";
$expiry=time()+3600;
$hash=md5($salt.$file.$expiry);

$url="download.php?file=$file&e=$expiry&h=$hash";

Now, when you process such a request, you can recalculate the hash and check that the presented hash is equal: this ensures that whoever made the URL knows the salt, which one hopes is just your site. If the hash is valid, then you can trust the expiry time, and if it hasn’t expired, allow the download.

You could include other things in the hash too if you like, like IP address and user-agent, if you wanted to have more confidence that the user-agent which requested the download link is the one which actually does the download.